Immediate practical steps for protecting emails, devices, social media, logs and files before forensic review.
This guide provides general educational information. It does not replace legal advice, regulatory guidance or a case-specific assessment.
Stop unnecessary interaction
Stop unnecessary interaction should be examined in relation to the specific objective of how to preserve digital evidence before it disappears. The enquiry should use relevant, authorised sources, distinguish verified facts from indicators, and explain where information is incomplete, conflicting or unavailable. Decisions should not rely on a single isolated record when context or corroboration is required.
A proportionate approach records source quality, date, context and practical limitations. Where the matter may affect legal, employment, regulatory, clinical or financial decisions, qualified advisers should interpret the findings within their professional role.
Record the current state
Record the current state should be examined in relation to the specific objective of how to preserve digital evidence before it disappears. The enquiry should use relevant, authorised sources, distinguish verified facts from indicators, and explain where information is incomplete, conflicting or unavailable. Decisions should not rely on a single isolated record when context or corroboration is required.
A proportionate approach records source quality, date, context and practical limitations. Where the matter may affect legal, employment, regulatory, clinical or financial decisions, qualified advisers should interpret the findings within their professional role.
Preserve original files
Preserve original files should be examined in relation to the specific objective of how to preserve digital evidence before it disappears. The enquiry should use relevant, authorised sources, distinguish verified facts from indicators, and explain where information is incomplete, conflicting or unavailable. Decisions should not rely on a single isolated record when context or corroboration is required.
A proportionate approach records source quality, date, context and practical limitations. Where the matter may affect legal, employment, regulatory, clinical or financial decisions, qualified advisers should interpret the findings within their professional role.
Protect devices and accounts
Protect devices and accounts should be examined in relation to the specific objective of how to preserve digital evidence before it disappears. The enquiry should use relevant, authorised sources, distinguish verified facts from indicators, and explain where information is incomplete, conflicting or unavailable. Decisions should not rely on a single isolated record when context or corroboration is required.
A proportionate approach records source quality, date, context and practical limitations. Where the matter may affect legal, employment, regulatory, clinical or financial decisions, qualified advisers should interpret the findings within their professional role.
Escalate expiring sources
Escalate expiring sources should be examined in relation to the specific objective of how to preserve digital evidence before it disappears. The enquiry should use relevant, authorised sources, distinguish verified facts from indicators, and explain where information is incomplete, conflicting or unavailable. Decisions should not rely on a single isolated record when context or corroboration is required.
A proportionate approach records source quality, date, context and practical limitations. Where the matter may affect legal, employment, regulatory, clinical or financial decisions, qualified advisers should interpret the findings within their professional role.
Document every handover
Document every handover should be examined in relation to the specific objective of how to preserve digital evidence before it disappears. The enquiry should use relevant, authorised sources, distinguish verified facts from indicators, and explain where information is incomplete, conflicting or unavailable. Decisions should not rely on a single isolated record when context or corroboration is required.
A proportionate approach records source quality, date, context and practical limitations. Where the matter may affect legal, employment, regulatory, clinical or financial decisions, qualified advisers should interpret the findings within their professional role.
Define the question, preserve relevant evidence, use proportionate methods and report limitations honestly.